Which of the following top security threats involves attempting to send invalid commands to an application in an attempt to get the application to execute the code?

Cross-site scripting (XSS) involves injecting malicious client-side scripts into web pages viewed by other users, typically to hijack sessions or deface websites, not to execute commands on the server.

Injection flaws, such as SQL injection, command injection, or NoSQL injection, occur when untrusted data is sent to an interpreter as part of a command or query. Attackers use this vulnerability to send invalid or malicious commands to an application, tricking it into executing unintended operations or revealing sensitive data by manipulating the underlying query or command structure.

Insecure direct object references occur when an application exposes a direct reference to an internal implementation object, such as a file or database key, allowing attackers to manipulate these references to access unauthorized data.

Cross-site request forgery (CSRF) tricks authenticated users into submitting a request to a web application without their knowledge, often to perform state-changing actions.